This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-newt.git
commit 4d2e2e5bf05e92b562b459b3b938fae3b69ae8b9 Author: Szymon Janc <[email protected]> AuthorDate: Mon Oct 19 17:46:32 2026 +0200 newt/extcmd: Fix panic on empty external command An empty or whitespace-only key in pkg.pre_build_cmds, pre_link_cmds or post_link_cmds produced no tokens after shell splitting and newt panicked indexing the first token when running the command. Reject such commands when reading the configuration, reporting the package that defines them, and guard against an empty token list before executing a command. Assisted-by: Claude:claude-opus-5-5 --- newt/build_errors_test.go | 84 +++++++++++++++++++++++++++++++++++++++++++++++ newt/builder/extcmd.go | 4 +++ newt/extcmd/extcmd.go | 13 ++++++++ 3 files changed, 101 insertions(+) diff --git a/newt/build_errors_test.go b/newt/build_errors_test.go new file mode 100644 index 00000000..eead14a1 --- /dev/null +++ b/newt/build_errors_test.go @@ -0,0 +1,84 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package main + +import ( + "os" + "path/filepath" + "strings" + "testing" +) + +// buildErrProject copies the syscfg_collision project to a temporary +// directory and adds a compiler definition which does not need a real +// compiler as long as nothing gets compiled. +func buildErrProject(t *testing.T) string { + t.Helper() + + dir := copyToTemp(t, filepath.Join("testdata", "syscfg_collision")) + yml := "compiler.path.cc: nonexistent-cc\n" + + "compiler.path.archive: nonexistent-ar\n" + + "compiler.flags.default: [-O1]\n" + path := filepath.Join(dir, "repos", "apache-mynewt-core", "compiler", + "sim", "compiler.yml") + if err := os.WriteFile(path, []byte(yml), 0644); err != nil { + t.Fatal(err) + } + + return dir +} + +// buildErrAppendFile appends text to a file. +func buildErrAppendFile(t *testing.T, path string, text string) { + t.Helper() + + f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0) + if err != nil { + t.Fatal(err) + } + defer f.Close() + + if _, err := f.WriteString(text); err != nil { + t.Fatal(err) + } +} + +func TestBuildEmptyExtCmd(t *testing.T) { + for _, key := range []string{"pre_build_cmds", "pre_link_cmds", + "post_link_cmds"} { + + t.Run(key, func(t *testing.T) { + dir := buildErrProject(t) + buildErrAppendFile(t, filepath.Join(dir, "apps", "app", + "pkg.yml"), "\npkg."+key+":\n ' ': 100\n") + + out, err := newtCombinedOutput(dir, nil, "build", "success") + if err == nil { + t.Fatalf("newt build succeeded unexpectedly:\n%s", out) + } + if strings.Contains(out, "panic") { + t.Fatalf("newt build panicked:\n%s", out) + } + if !strings.Contains(out, "apps/app: invalid command") { + t.Fatalf("unexpected newt build output:\n%s", out) + } + }) + } +} diff --git a/newt/builder/extcmd.go b/newt/builder/extcmd.go index d14144cd..67bc62e5 100644 --- a/newt/builder/extcmd.go +++ b/newt/builder/extcmd.go @@ -157,6 +157,10 @@ func (t *TargetBuilder) execExtCmds(sf stage.StageFunc, userSrcDir string, return util.FmtNewtError( "invalid command string: \"%s\": %s", sf.Name, err.Error()) } + if len(toks) == 0 { + return util.FmtNewtError("empty command string in package %s", + sf.Pkg.FullName()) + } // Replace environment variables in command string. for i, tok := range toks { diff --git a/newt/extcmd/extcmd.go b/newt/extcmd/extcmd.go index 7cd00427..6e51cbe1 100644 --- a/newt/extcmd/extcmd.go +++ b/newt/extcmd/extcmd.go @@ -21,6 +21,8 @@ package extcmd import ( "fmt" + + "github.com/kballard/go-shellquote" "mynewt.apache.org/newt/newt/cfgv" "mynewt.apache.org/newt/newt/pkg" @@ -54,6 +56,17 @@ func (ecfg *ExtCmdCfg) readOnePkg(lpkg *pkg.LocalPackage, cfg *syscfg.Cfg, cmdMap := getMapCb(lpkg, settings) for name, stageStr := range cmdMap { + toks, err := shellquote.Split(name) + if err != nil || len(toks) == 0 { + text := fmt.Sprintf("%s: invalid command \"%s\"", + lpkg.FullName(), name) + if err != nil { + text += ": " + err.Error() + } + ecfg.InvalidSettings = append(ecfg.InvalidSettings, text) + continue + } + sf, err := stage.NewStageFunc(name, stageStr, lpkg, cfg) if err != nil { text := fmt.Sprintf("%s: %s", lpkg.FullName(), err.Error())
